Governance & assurance

How we keep people, data and decisions safe

Assistiv builds assistive technology for independent living. This page sets out, in plain English, where we stand against the NHS Digital Technology Assessment Criteria — clinical safety, data protection, technical security, interoperability, and usability and accessibility — alongside our safeguarding and regulatory positioning. What is in place today, and what is in progress. We would rather show you an honest status than a polished claim.

Our position in one paragraph

Assistiv products are assistive, not diagnostic. They inform, signpost and support; they do not diagnose disease, treat any condition, or make autonomous clinical decisions. Wherever our tools generate information that may be useful to a health or care professional, that information is advisory, and assessment, diagnosis and treatment decisions always rest with qualified professionals. A human reviews every escalation. On this basis our products are not placed on the UK market as medical devices. We keep this position under continuous review as our products evolve and as MHRA guidance on software develops, and we will seek regulatory advice before introducing any feature with a medical purpose.

This is a deliberate design constraint, not an afterthought. It shapes what our tools claim, what they measure, and how their outputs are worded. Independence, safety and wellbeing are our intended purposes. Where a signal might prompt a clinical question, our job ends at suggesting a conversation with a GP, and the person decides whether to have it.

Three layers, three different governance profiles

The ecosystem handles three very different kinds of information, and each layer is governed according to what it actually touches.

assistiv.cloud · population intelligence

Open data only. No people.

The intelligence layer is built entirely from published open data: NHS Fingertips, NHSBSA prescribing statistics, ONS Census, deprivation indices. It contains no patient identifiers and no personal data of any kind, so UK GDPR does not bite at this layer at all.

  • Methodology published in full, including signal weights and limitations
  • Data freshness checkable live by anyone on our data status page
  • Scores describe places, never people; no output below neighbourhood level
assistiv.tools · community screening

Consent first. The person holds the output.

The voice-first screen uses validated, publicly documented questionnaires. It is a signposting conversation, not a clinical assessment: it produces information for the person, and a structured summary that the person chooses whether to share with their GP. Nothing is sent anywhere without their explicit agreement.

  • Three-layer consent; the person can stop, skip or withdraw at any point
  • No diagnosis is made or implied; outputs suggest conversations, not conclusions
  • Crisis and safeguarding routing with human follow-up, never automated action
assistiv.services · the home platform

The person is the author, not the subject.

The home platform is built on a privacy architecture we consider stricter than the sector norm: raw sensor data is processed at the edge, inside the home, and never leaves it. Only derived insight scores are transmitted. There are no cameras and no wearables. The person controls what is monitored, what is shared and with whom, and every choice is reversible.

  • Edge processing by design; raw audio and sensor streams stay within the four walls
  • Graduated adoption: conversation only, one chosen sensor, or the full platform
  • Consent can be granted, narrowed or withdrawn at any time, by the person

Safeguarding, designed in

Where the home platform detects patterns that may indicate neglect, self-neglect or abuse, a defined escalation pathway applies, aligned to the Care Act 2014 and the Making Safeguarding Personal principles. Two rules are absolute: a human reviews every flag before anything happens, and the dignity of risk is respected, meaning adults are never overridden for convenience.

What the platform can surface

  • Possible neglect or self-neglect: progressive withdrawal from daily routines
  • Acoustic distress events and sudden movement anomalies
  • Unusual visitor or access patterns
  • Carer distress: a carer wellbeing score below threshold triggers an independent pathway

The escalation pathway

  1. A named safeguarding lead reviews the signals. Human decision, always.
  2. The carer is contacted for an observational report, unless the carer is the potential risk source.
  3. The GP is informed and an assessment referral recommended.
  4. Where warranted, the Local Authority adult safeguarding duty team is notified.

DTAC readiness: our position against the five criteria

NHS organisations assess digital health tools against the Digital Technology Assessment Criteria (DTAC) — five areas covering clinical safety, data protection, technical security, interoperability, and usability and accessibility. We have structured our assurance position around those five criteria so that commissioners can see, before any procurement conversation begins, exactly where we stand. Statuses are updated as work completes. We would rather show you an honest status than a polished claim.

DTAC C1 · Clinical safety In preparation

Assistive, not diagnostic — with clinical risk management to follow deployment

Our products inform, signpost and support; they do not diagnose, treat, or make autonomous clinical decisions, and a human reviews every escalation. On this basis they are not placed on the UK market as medical devices, a position we keep under continuous review against MHRA software guidance.

  • UK MDR / MHRA position: stated and published — reviewed before any feature change that could alter intended purpose
  • DCB0129 / DCB0160: planned — a clinical safety case and named Clinical Safety Officer will accompany any commissioned NHS deployment
  • Validated instruments: screening is built on PRISMA-7, the FRAIL Scale and BGS Fit for Frailty, scored as published
DTAC C2 · Data protection Strong by design

Open data where possible. Consent everywhere else.

The intelligence layer holds no personal data of any kind. The screening and home platform layers are consent-first: nothing is stored, transmitted or shared unless the person explicitly chooses it, and every consent is granular and revocable.

  • UK GDPR & Data Protection Act 2018: in place — lawful basis, data minimisation and rights handling documented in our Privacy Notice
  • DPIA: in progress — drafted alongside first deployment conversations; shared with partners on request
  • Data Security and Protection Toolkit (DSPT): planned — registration scheduled ahead of any NHS data-sharing agreement
  • Edge processing: raw sensor and audio data is processed inside the home and never leaves it; only derived signals travel
DTAC C3 · Technical security In progress

A small attack surface, by architecture

Our public platforms are static sites with no user accounts, no databases of personal information, and no stored credentials. The screening conversation is processed transiently and is not retained by Assistiv. This is a deliberately small attack surface, and we intend to certify it.

  • Cyber Essentials: planned — scheduled ahead of the first NHS data-sharing agreement
  • Hosting: served over HTTPS with TLS throughout; no server-side processing of personal data on public sites
  • Secure development: all source published and inspectable; data freshness checkable live on our data status page
DTAC C4 · Interoperability In preparation

Structured outputs, open standards, honest gaps

Screening produces a structured clinical referral — domain scores, minimisation notes and a CGA preparation brief — designed to be read by a frailty team today and consumed by clinical systems tomorrow. The intelligence layer is built entirely on open, published NHS and ONS datasets with documented provenance.

  • Structured referral format: in place — human-readable today, designed for export
  • FHIR / GP Connect integration: planned — scoped for commissioned deployment, in partnership with the receiving PCN's system supplier
  • Open data provenance: in place — every signal source, weight and limitation published in the methodology
DTAC C5 · Usability & accessibility In progress

Voice-first because forms exclude the very people we serve

The screening tool is a spoken conversation precisely because tick-boxes and small print exclude many older adults. Voice-first design reduces barriers by default, but it does not exempt us from the standard: we are working towards WCAG 2.2 AA across the estate and publish our position openly.

  • WCAG 2.2 AA: in progress — current status, known issues and roadmap published in our Accessibility Statement
  • NHS Service Standard alignment: design principles follow plain-language, person-led NHS service design guidance
  • User research: next stage is formal co-development with geriatricians, frailty nurses and older adults themselves

If a status above matters to your organisation and you need detail or evidence — the DPIA draft, the methodology pack, or the clinical safety scoping — ask us: simon@assistiv.co.

Independent challenge

Good governance includes people whose job is to disagree with us. Our advisory board brings social care outcomes measurement, quantitative research methods, nursing and ageing practice, and public administration into the room, and our intelligence platform ships with VERA, a built-in validator whose role is to argue against our own scores.

Prof. Ann Netten
Emeritus Professor · University of Kent · ASCOT

Creator of the Adult Social Care Outcomes Toolkit, used by councils across the UK and internationally. Former Director of the PSSRU.

Prof. John Jerrim
Professor of Social Statistics · UCL

Director of UCL's Quantitative Social Science Research Centre. Brings large-scale data methodology to our evidence base.

Mark Greenfield
Emeritus · Nursing & Ageing

Retired nursing and ageing lecturer, active in older people's advocacy. Validated the three-state independence model that underpins our design.

Prof. Tim Legrand
Professor of Politics · University of Adelaide

Expert in government policy and public administration, advising on commissioning and policy landscapes.

What we will not do

Some lines are easier to hold when they are written down in public. Assistiv will not sell personal data. We will not install anything in a home without the person's explicit agreement, and we will not make removal difficult. We will not use cameras. We will not let an algorithm take a safeguarding action without a human decision. We will not describe modelled estimates as measurements, in our marketing or anywhere else. Where we fall short of any of these, we want to be told: simon@assistiv.co.